From 02ebe72479a38be7414fb425662904726aca4d48 Mon Sep 17 00:00:00 2001 From: Manoel Aranda Neto Date: Mon, 24 Aug 2026 12:38:02 +0200 Subject: [PATCH 1/2] fix(ci): skip changeset hygiene without comment permissions --- .github/workflows/changeset-hygiene.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/changeset-hygiene.yml b/.github/workflows/changeset-hygiene.yml index a85b37a..f72a407 100644 --- a/.github/workflows/changeset-hygiene.yml +++ b/.github/workflows/changeset-hygiene.yml @@ -15,6 +15,8 @@ permissions: jobs: check: + # Fork and Dependabot PR tokens are read-only, so they cannot upsert the report comment. + if: github.event.pull_request.head.repo.full_name == github.repository && github.actor != 'dependabot[bot]' name: Check changeset hygiene runs-on: ubuntu-latest timeout-minutes: 10 From 90cfcabba901213d502df958cb33c97d20afe1a8 Mon Sep 17 00:00:00 2001 From: Manoel Aranda Neto Date: Mon, 24 Aug 2026 12:52:16 +0200 Subject: [PATCH 2/2] fix(ci): skip project board updates without app credentials --- .github/workflows/flags-project-board.yml | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/.github/workflows/flags-project-board.yml b/.github/workflows/flags-project-board.yml index ae19559..cd2d2ba 100644 --- a/.github/workflows/flags-project-board.yml +++ b/.github/workflows/flags-project-board.yml @@ -73,11 +73,13 @@ jobs: # the github.event_name is supposed to be `workflow_call`, but because this workflow lives in the special `.github` repository, # it preserves the original event name (e.g. pull_request). # This is a not well-documented special case. - # Dependabot-triggered runs execute in a restricted secret context with no - # access to PROJECT_BOARD_BOT_APP_ID / PRIVATE_KEY, so the token step below - # hard-fails because the client ID is empty on every dependency-bump - # PR. Skip them — dependency bumps don't belong on the feature flags board. - if: (github.event_name == 'workflow_dispatch' || github.event_name == 'pull_request' || github.event_name == 'pull_request_review') && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository) && github.actor != 'dependabot[bot]' + # Fork and Dependabot PRs run without the GitHub App credentials required below. + # On pull_request_review, github.actor is the reviewer, so inspect the PR author instead. + if: >- + github.event_name == 'workflow_dispatch' || + ((github.event_name == 'pull_request' || github.event_name == 'pull_request_review') && + github.event.pull_request.head.repo.full_name == github.repository && + github.event.pull_request.user.login != 'dependabot[bot]') steps: - name: Generate GitHub App Token id: app-token